Add allow/deny feature for forward URLs about request-baskets

[darklynx]

I think that the unrestricted forwarding feature made the Request Baskets "famous" and got us to the CVE database 😅:
https://nvd.nist.gov/vuln/detail/CVE-2023-27163

And some samples of Request Baskets misuse, when running the service non-isolated from the rest of your network 😰:
https://cyb3rc4t.hashnode.dev/htb-writeupsau

[eliliam]

Any update on this? This would be a great feature to add

[darklynx]

PRs are welcome

[darklynx]

we operate the application in kubernetes and want to avoid access to internal ressources via request-baskets, as it can be turned into an open proxy.

That is a very valid concern 👍

The easiest solution is an option to disable forwarding in general.

The proposed solution sounds like a reasonable amount of development with additional testing of corner cases like resolving a domain into IP and sub-network. Maybe there are already libraries in Go that solves that problem and they can be easily applied here. But I'm not aware of them, and not that familiar with such kind of libraries. Also I have a limited free time at the moment.

Hence, PRs for improvements are welcome and very much appreciated.

Thank you! 🙏